WatchGuard Firebox appliances running Fireware OS have been the focus of multiple government and vendor advisories following disclosure of a critical vulnerability tracked as CVE-2025-14733. The issue affects systems using IKEv2 VPN and has been described by the Canadian Centre for Cyber Security as an out-of-bounds write vulnerability in the iked IKE daemon, a core component responsible for establishing authenticated remote access sessions.
In practical terms, the vulnerability sits in the software that brokers encrypted VPN connections between users, branch offices, and internal networks where identity and access controls are enforced. An out-of-bounds write means the system can be forced to write data outside the memory area it is intended to use, which can allow an attacker to execute arbitrary code on the device. Because the flaw can be triggered remotely and does not require prior authentication, an attacker does not need valid user credentials to gain a foothold. This places the vulnerability squarely at the edge of identity infrastructure, where VPN gateways often act as the first control point for user authentication and authorization.
According to the Cyber Centre, successful exploitation can allow remote, unauthenticated arbitrary code execution under specific VPN configuration conditions. The affected scenarios include Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 where a dynamic gateway peer is enabled or was previously enabled. The advisory clarifies that exposure is not limited to a single deployment model and can persist even if the dynamic peer setting was enabled only in the past.
Exploitation status has elevated concern around the flaw. The Canadian Cyber Centre states it is aware of open-source reporting indicating active exploitation, and the U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2025-14733 to its Known Exploited Vulnerabilities catalog. Inclusion in the KEV list typically signals that exploitation has moved beyond theoretical risk and is being observed in real-world environments.
The Cyber Centre has published a list of fixed versions addressing the issue, including Fireware OS 2025.1.4 for the 2025.1 release train, version 12.11.6 for 12.x, version 12.5.15 for T15 and T35 models, and 12.3.1_Update4 for FIPS-certified systems. Fireware OS 11.x is listed as end of life and does not receive a patch.
Mitigation guidance emphasizes urgent patching and review of logs and traffic for indicators of compromise referenced by WatchGuard advisories. Where immediate patching is not feasible, the Cyber Centre points to configuration-based steps such as disabling dynamic peer Branch Office VPN configurations and limiting VPN exposure, measures aimed at reducing attack paths into identity and access-controlled environments.
Sources: Canadian Centre for Cyber Security, WatchGuard, NIST NVD
—
By the ID Tech Editorial Team
